[proxmark3-svn] / client / cmdhficlass.c

//-----------------------------------------------------------------------------
// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
// Copyright (C) 2011 Gerhard de Koning Gans
// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
// the license.
//-----------------------------------------------------------------------------
// High frequency iClass commands
//-----------------------------------------------------------------------------

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
#include "data.h"
//#include "proxusb.h"
#include "proxmark3.h"
#include "ui.h"
#include "cmdparser.h"
#include "cmdhficlass.h"
#include "common.h"
#include "util.h"
#include "cmdmain.h"
#include "loclass/des.h"
#include "loclass/cipherutils.h"
#include "loclass/cipher.h"
#include "loclass/ikeys.h"
#include "loclass/elite_crack.h"
#include "loclass/fileutils.h"

static int CmdHelp(const char *Cmd);

int xorbits_8(uint8_t val)
{
    uint8_t res = val ^ (val >> 1); //1st pass
    res = res ^ (res >> 1); 		// 2nd pass
    res = res ^ (res >> 2); 		// 3rd pass
    res = res ^ (res >> 4); 			// 4th pass
    return res & 1;
}

int CmdHFiClassList(const char *Cmd)
{

	bool ShowWaitCycles = false;
	char param = param_getchar(Cmd, 0);

	if (param != 0) {
		PrintAndLog("List data in trace buffer.");
		PrintAndLog("Usage:  hf iclass list");
		PrintAndLog("h - help");
		PrintAndLog("sample: hf iclass list");
		return 0;
	}

	uint8_t got[1920];
	GetFromBigBuf(got,sizeof(got),0);
	WaitForResponse(CMD_ACK,NULL);

	PrintAndLog("Recorded Activity");
	PrintAndLog("");
	PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
	PrintAndLog("All times are in carrier periods (1/13.56Mhz)");
	PrintAndLog("");
	PrintAndLog("     Start |       End | Src | Data");
	PrintAndLog("-----------|-----------|-----|--------");

	int i;
	uint32_t first_timestamp = 0;
	uint32_t timestamp;
	bool tagToReader;
	uint32_t parityBits;
	uint8_t len;
	uint8_t *frame;
	uint32_t EndOfTransmissionTimestamp = 0;


	for( i=0; i < 1900;)
	{
		//First 32 bits contain
		// isResponse (1 bit)
		// timestamp (remaining)
		//Then paritybits
		//Then length
		timestamp = *((uint32_t *)(got+i));
		parityBits = *((uint32_t *)(got+i+4));
		len = got[i+8];
        frame = (got+i+9);
		uint32_t next_timestamp = (*((uint32_t *)(got+i+9))) & 0x7fffffff;

		tagToReader = timestamp & 0x80000000;
		timestamp &= 0x7fffffff;

		if(i==0) {
			first_timestamp = timestamp;
		}

        // Break and stick with current result idf buffer was not completely full
		if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break;

		char line[1000] = "";

		if(len)//We have some data to display
		{
			int j,oddparity;

			for(j = 0; j < len ; j++)
			{
				oddparity = 0x01 ^ xorbits_8(frame[j] & 0xFF);

				if (tagToReader && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
					sprintf(line+(j*4), "%02x!  ", frame[j]);
				} else {
					sprintf(line+(j*4), "%02x   ", frame[j]);
				}
			}
		}else
		{
			if (ShowWaitCycles) {
				sprintf(line, "fdt (Frame Delay Time): %d", (next_timestamp - timestamp));
			}
		}

		char *crc = "";

		if(len > 2)
		{
			uint8_t b1, b2;
			if(!tagToReader && len == 4) {
				// Rough guess that this is a command from the reader
				// For iClass the command byte is not part of the CRC
					ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
			}
			else {
				  // For other data.. CRC might not be applicable (UPDATE commands etc.)
				ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
			}

			if (b1 != frame[len-2] || b2 != frame[len-1]) {
				crc = (tagToReader & (len < 8)) ? "" : " !crc";
			}
		}

		i += (len + 9);
		EndOfTransmissionTimestamp = (*((uint32_t *)(got+i))) & 0x7fffffff;

		// Not implemented for iclass on the ARM-side
		//if (!ShowWaitCycles) i += 9;

		PrintAndLog(" %9d | %9d | %s | %s %s",
			(timestamp - first_timestamp),
			(EndOfTransmissionTimestamp - first_timestamp),
			(len?(tagToReader ? "Tag" : "Rdr"):"   "),
			line, crc);
	}
	return 0;
}

int CmdHFiClassListOld(const char *Cmd)
{
  uint8_t got[1920];
  GetFromBigBuf(got,sizeof(got),0);

  PrintAndLog("recorded activity:");
  PrintAndLog(" ETU     :rssi: who bytes");
  PrintAndLog("---------+----+----+-----------");

  int i = 0;
  int prev = -1;

  for (;;) {
    if(i >= 1900) {
      break;
    }

    bool isResponse;
    int timestamp = *((uint32_t *)(got+i));
    if (timestamp & 0x80000000) {
      timestamp &= 0x7fffffff;
      isResponse = 1;
    } else {
      isResponse = 0;
    }


    int metric = 0;

    int parityBits = *((uint32_t *)(got+i+4));
    // 4 bytes of additional information...
    // maximum of 32 additional parity bit information
    //
    // TODO:
    // at each quarter bit period we can send power level (16 levels)
    // or each half bit period in 256 levels.


    int len = got[i+8];

    if (len > 100) {
      break;
    }
    if (i + len >= 1900) {
      break;
    }

    uint8_t *frame = (got+i+9);

    // Break and stick with current result if buffer was not completely full
    if (frame[0] == 0x44 && frame[1] == 0x44 && frame[3] == 0x44) { break; }

    char line[1000] = "";
    int j;
    for (j = 0; j < len; j++) {
      int oddparity = 0x01;
      int k;

      for (k=0;k<8;k++) {
        oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
      }

      //if((parityBits >> (len - j - 1)) & 0x01) {
      if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
        sprintf(line+(j*4), "%02x!  ", frame[j]);
      }
      else {
        sprintf(line+(j*4), "%02x   ", frame[j]);
      }
    }

    char *crc;
    crc = "";
    if (len > 2) {
      uint8_t b1, b2;
      for (j = 0; j < (len - 1); j++) {
        // gives problems... search for the reason..
        /*if(frame[j] == 0xAA) {
          switch(frame[j+1]) {
            case 0x01:
              crc = "[1] Two drops close after each other";
            break;
            case 0x02:
              crc = "[2] Potential SOC with a drop in second half of bitperiod";
              break;
            case 0x03:
              crc = "[3] Segment Z after segment X is not possible";
              break;
            case 0x04:
              crc = "[4] Parity bit of a fully received byte was wrong";
              break;
            default:
              crc = "[?] Unknown error";
              break;
          }
          break;
        }*/
      }

      if (strlen(crc)==0) {
	if(!isResponse && len == 4) {
		// Rough guess that this is a command from the reader
		// For iClass the command byte is not part of the CRC
	        ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
	}
	else {
		// For other data.. CRC might not be applicable (UPDATE commands etc.)
	        ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
	}
	//printf("%1x %1x",(unsigned)b1,(unsigned)b2);
        if (b1 != frame[len-2] || b2 != frame[len-1]) {
          crc = (isResponse & (len < 8)) ? "" : " !crc";
        } else {
          crc = "";
        }
      }
    } else {
      crc = ""; // SHORT
    }

    char metricString[100];
    if (isResponse) {
      sprintf(metricString, "%3d", metric);
    } else {
      strcpy(metricString, "   ");
    }

    PrintAndLog(" +%7d: %s: %s %s %s",
      (prev < 0 ? 0 : (timestamp - prev)),
      metricString,
      (isResponse ? "TAG" : "   "), line, crc);

    prev = timestamp;
    i += (len + 9);
  }
  return 0;
}

int CmdHFiClassSnoop(const char *Cmd)
{
  UsbCommand c = {CMD_SNOOP_ICLASS};
  SendCommand(&c);
  return 0;
}
#define NUM_CSNS 15
int CmdHFiClassSim(const char *Cmd)
{
  uint8_t simType = 0;
  uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};

  if (strlen(Cmd)<1) {
	PrintAndLog("Usage:  hf iclass sim [0 <CSN>] | x");
	PrintAndLog("        options");
	PrintAndLog("                0 <CSN> simulate the given CSN");
	PrintAndLog("                1       simulate default CSN");
	PrintAndLog("                2       iterate CSNs, gather MACs");
	PrintAndLog("        sample: hf iclass sim 0 031FEC8AF7FF12E0");
	PrintAndLog("        sample: hf iclass sim 2");
	return 0;
  }	

  simType = param_get8(Cmd, 0);

  if(simType == 0)
  {
	  if (param_gethex(Cmd, 1, CSN, 16)) {
		  PrintAndLog("A CSN should consist of 16 HEX symbols");
		  return 1;
	  }
	  PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));

  }
  if(simType > 2)
  {
	  PrintAndLog("Undefined simptype %d", simType);
	  return 1;
  }
  uint8_t numberOfCSNs=0;

	if(simType == 2)
	{
		UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
		UsbCommand resp = {0};

		/*uint8_t csns[8 * NUM_CSNS] = {
			 0x00,0x0B,0x0F,0xFF,0xF7,0xFF,0x12,0xE0 ,
			 0x00,0x13,0x94,0x7e,0x76,0xff,0x12,0xe0 ,
			 0x2a,0x99,0xac,0x79,0xec,0xff,0x12,0xe0 ,
			 0x17,0x12,0x01,0xfd,0xf7,0xff,0x12,0xe0 ,
			 0xcd,0x56,0x01,0x7c,0x6f,0xff,0x12,0xe0 ,
			 0x4b,0x5e,0x0b,0x72,0xef,0xff,0x12,0xe0 ,
			 0x00,0x73,0xd8,0x75,0x58,0xff,0x12,0xe0 ,
			 0x0c,0x90,0x32,0xf3,0x5d,0xff,0x12,0xe0 };
*/
      
       uint8_t csns[8*NUM_CSNS] = {
        0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
        0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };

		memcpy(c.d.asBytes, csns, 8*NUM_CSNS);

		SendCommand(&c);
		if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
			PrintAndLog("Command timed out");
			return 0;
		}

		uint8_t num_mac_responses  = resp.arg[1];
		PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);

		size_t datalen = NUM_CSNS*24;
		/*
		 * Now, time to dump to file. We'll use this format:
		 * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
		 * So, it should wind up as
		 * 8 * 24 bytes.
		 *
		 * The returndata from the pm3 is on the following format
		 * <4 byte NR><4 byte MAC>
		 * CC are all zeroes, CSN is the same as was sent in
		 **/
		void* dump = malloc(datalen);
		memset(dump,0,datalen);//<-- Need zeroes for the CC-field
		uint8_t i = 0;
		for(i = 0 ; i < NUM_CSNS ; i++)
		{
			memcpy(dump+i*24, csns+i*8,8); //CSN
			//8 zero bytes here...
			//Then comes NR_MAC (eight bytes from the response)
			memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);

		}
		/** Now, save to dumpfile **/
		saveFile("iclass_mac_attack", "bin", dump,datalen);
		free(dump);
	}else
	{
		UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
		memcpy(c.d.asBytes, CSN, 8);
		SendCommand(&c);
	}

  return 0;
}

int CmdHFiClassReader(const char *Cmd)
{
  UsbCommand c = {CMD_READER_ICLASS, {0}};
  SendCommand(&c);
    UsbCommand resp;
  while(!ukbhit()){
      if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
            uint8_t isOK    = resp.arg[0] & 0xff;
            uint8_t * data  = resp.d.asBytes;

            PrintAndLog("isOk:%02x", isOK);

            if(isOK > 0)
            {
                PrintAndLog("CSN: %s",sprint_hex(data,8));
            }
            if(isOK >= 1)
            {
                PrintAndLog("CC: %s",sprint_hex(data+8,8));
            }else{
                PrintAndLog("No CC obtained");
            }
        } else {
            PrintAndLog("Command execute timeout");
        }
    }

  return 0;
}

int CmdHFiClassReader_Replay(const char *Cmd)
{
  uint8_t readerType = 0;
  uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};

  if (strlen(Cmd)<1) {
    PrintAndLog("Usage:  hf iclass replay <MAC>");
    PrintAndLog("        sample: hf iclass replay 00112233");
    return 0;
  }

  if (param_gethex(Cmd, 0, MAC, 8)) {
    PrintAndLog("MAC must include 8 HEX symbols");
    return 1;
  }

  UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
  memcpy(c.d.asBytes, MAC, 4);
  SendCommand(&c);

  return 0;
}

int CmdHFiClassReader_Dump(const char *Cmd)
{
  uint8_t readerType = 0;
  uint8_t MAC[4]={0x00,0x00,0x00,0x00};
  uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  //uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t keytable[128] = {0};
  int elite = 0;
  uint8_t *used_key;
  int i;
  if (strlen(Cmd)<1) 
  {
    PrintAndLog("Usage:  hf iclass dump <Key> [e]");
    PrintAndLog("        Key    - A 16 byte master key");
    PrintAndLog("        e      - If 'e' is specified, the key is interpreted as the 16 byte");
    PrintAndLog("                 Custom Key (KCus), which can be obtained via reader-attack");
    PrintAndLog("                 See 'hf iclass sim 2'. This key should be on iclass-format");
    PrintAndLog("        sample: hf iclass dump 0011223344556677");


    return 0;
  }

  if (param_gethex(Cmd, 0, KEY, 16)) 
  {
    PrintAndLog("KEY must include 16 HEX symbols");
    return 1;
  }

  if (param_getchar(Cmd, 1) == 'e')
  {
    PrintAndLog("Elite switch on");
    elite = 1;

    //calc h2
    hash2(KEY, keytable);
    printarr_human_readable("keytable", keytable, 128);

  }

  UsbCommand resp;
  uint8_t key_sel[8] = {0};
  uint8_t key_sel_p[8] = { 0 };

  //HACK -- Below is for testing without access to a tag
  uint8_t xdata[16] = {0x01,0x02,0x03,0x04,0xF7,0xFF,0x12,0xE0, //CSN from http://www.proxmark.org/forum/viewtopic.php?pid=11230#p11230
                      0xFE,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF}; // Just a random CC. Would be good to add a real testcase here
  memcpy(resp.d.asBytes,xdata, 16);
  resp.arg[0] = 2;
  uint8_t fake_dummy_test = false;
  //End hack


  UsbCommand c = {CMD_READER_ICLASS, {0}};
  c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE;
  if(!fake_dummy_test)   
    SendCommand(&c);
  

  if (fake_dummy_test || WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
        uint8_t isOK    = resp.arg[0] & 0xff;
        uint8_t * data  = resp.d.asBytes;

        memcpy(CSN,data,8);
        memcpy(CCNR,data+8,8);

        PrintAndLog("isOk:%02x", isOK);

        if(isOK > 0)
        {
            PrintAndLog("CSN: %s",sprint_hex(CSN,8));
        }
        if(isOK > 1)
        {
            if(elite)
            {
                //Get the key index (hash1)
                uint8_t key_index[8] = {0};

                hash1(CSN, key_index);
                printvar("hash1", key_index,8);
                for(i = 0; i < 8 ; i++)
                    key_sel[i] = keytable[key_index[i]] & 0xFF;
                PrintAndLog("Pre-fortified 'permuted' HS key that would be needed by an iclass reader to talk to above CSN:");
                printvar("k_sel", key_sel,8);
                //Permute from iclass format to standard format
                permutekey_rev(key_sel,key_sel_p);
                used_key = key_sel_p;
            }else{
                //Perhaps this should also be permuted to std format?
                // Something like the code below? I have no std system
                // to test this with /Martin

                //uint8_t key_sel_p[8] = { 0 };
                //permutekey_rev(KEY,key_sel_p);
                //used_key = key_sel_p;

                used_key = KEY;

            }

            PrintAndLog("Pre-fortified key that would be needed by the OmniKey reader to talk to above CSN:");
            printvar("Used key",used_key,8);
            diversifyKey(CSN,used_key, div_key);
            PrintAndLog("Hash0, a.k.a diversified key, that is computed using Ksel and stored in the card (Block 3):");
            printvar("Div key", div_key, 8);
            printvar("CC_NR:",CCNR,12);
            doMAC(CCNR,12,div_key, MAC);
            printvar("MAC", MAC, 4);

            UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
            memcpy(d.d.asBytes, MAC, 4);
            if(!fake_dummy_test) SendCommand(&d);

        }else{
            PrintAndLog("Failed to obtain CC! Aborting");
        }
    } else {
        PrintAndLog("Command execute timeout");
    }

  return 0;
}

int CmdHFiClass_iso14443A_write(const char *Cmd)
{
  uint8_t readerType = 0;
  uint8_t MAC[4]={0x00,0x00,0x00,0x00};
  uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
  uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};

  uint8_t blockNo=0;
  uint8_t bldata[8]={0};

  if (strlen(Cmd)<3) 
  {
    PrintAndLog("Usage:  hf iclass write <Key> <Block> <Data>");
    PrintAndLog("        sample: hf iclass write 0011223344556677 10 AAAAAAAAAAAAAAAA");
    return 0;
  }

  if (param_gethex(Cmd, 0, KEY, 16)) 
  {
    PrintAndLog("KEY must include 16 HEX symbols");
    return 1;
  }
  
  blockNo = param_get8(Cmd, 1);
  if (blockNo>32)
  {
        PrintAndLog("Error: Maximum number of blocks is 32 for iClass 2K Cards!");
        return 1;
  }
  if (param_gethex(Cmd, 2, bldata, 8)) 
  {
        PrintAndLog("Block data must include 8 HEX symbols");
        return 1;
  }
  
  UsbCommand c = {CMD_ICLASS_ISO14443A_WRITE, {0}};
  SendCommand(&c);
  UsbCommand resp;

  if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
    uint8_t isOK    = resp.arg[0] & 0xff;
    uint8_t * data  = resp.d.asBytes;
    
    memcpy(CSN,data,8);
    memcpy(CCNR,data+8,8);
    PrintAndLog("DEBUG: %s",sprint_hex(CSN,8));
    PrintAndLog("DEBUG: %s",sprint_hex(CCNR,8));
	PrintAndLog("isOk:%02x", isOK);
  } else {
	PrintAndLog("Command execute timeout");
  }

  diversifyKey(CSN,KEY, div_key);

  PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
  doMAC(CCNR, 12,div_key, MAC);

  UsbCommand c2 = {CMD_ICLASS_ISO14443A_WRITE, {readerType,blockNo}};
  memcpy(c2.d.asBytes, bldata, 8);
  memcpy(c2.d.asBytes+8, MAC, 4);
  SendCommand(&c2);

  if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
    uint8_t isOK    = resp.arg[0] & 0xff;
    uint8_t * data  = resp.d.asBytes;

    if (isOK)
      PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));
    else
      PrintAndLog("isOk:%02x", isOK);
  } else {
      PrintAndLog("Command execute timeout");
  }
  return 0;
}


static command_t CommandTable[] = 
{
  {"help",	CmdHelp,			1,	"This help"},
  {"list",	CmdHFiClassList,	0,	"List iClass history"},
  {"snoop",	CmdHFiClassSnoop,	0,	"Eavesdrop iClass communication"},
  {"sim",	CmdHFiClassSim,		0,	"Simulate iClass tag"},
  {"reader",CmdHFiClassReader,	0,	"Read an iClass tag"},
  {"replay",CmdHFiClassReader_Replay,	0,	"Read an iClass tag via Reply Attack"},
  {"dump",	CmdHFiClassReader_Dump,	0,		"Authenticate and Dump iClass tag"},
  {"write",	CmdHFiClass_iso14443A_write,	0,	"Authenticate and Write iClass block"},
  {NULL, NULL, 0, NULL}
};

int CmdHFiClass(const char *Cmd)
{
  CmdsParse(CommandTable, Cmd);
  return 0;
}

int CmdHelp(const char *Cmd)
{
  CmdsHelp(CommandTable);
  return 0;
}
Commit	Line	Data
cee5a30d	1	//-----------------------------------------------------------------------------
	2	// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
	3	// Copyright (C) 2011 Gerhard de Koning Gans
26c0d833	4	// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
cee5a30d	5	//
	6	// This code is licensed to you under the terms of the GNU GPL, version 2 or,
	7	// at your option, any later version. See the LICENSE.txt file for the text of
	8	// the license.
	9	//-----------------------------------------------------------------------------
	10	// High frequency iClass commands
	11	//-----------------------------------------------------------------------------
	12
	13	#include <stdio.h>
	14	#include <stdlib.h>
	15	#include <string.h>
9f6e9d15	16	#include <sys/stat.h>
cee5a30d	17	#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
cee5a30d	18	#include "data.h"
28fdb04f	19	//#include "proxusb.h"
902cb3c0	20	#include "proxmark3.h"
cee5a30d	21	#include "ui.h"
	22	#include "cmdparser.h"
	23	#include "cmdhficlass.h"
	24	#include "common.h"
14006804	25	#include "util.h"
17cba269	26	#include "cmdmain.h"
a66fca86 AD	27	#include "loclass/des.h"
	28	#include "loclass/cipherutils.h"
	29	#include "loclass/cipher.h"
	30	#include "loclass/ikeys.h"
3ad48540 MHS	31	#include "loclass/elite_crack.h"
3ad48540 MHS	32	#include "loclass/fileutils.h"
cee5a30d	33
	34	static int CmdHelp(const char *Cmd);
	35
17cba269 MHS	36	int xorbits_8(uint8_t val)
17cba269 MHS	37	{
3ad48540 MHS	38	uint8_t res = val ^ (val >> 1); //1st pass
	39	res = res ^ (res >> 1); // 2nd pass
	40	res = res ^ (res >> 2); // 3rd pass
	41	res = res ^ (res >> 4); // 4th pass
	42	return res & 1;
17cba269 MHS	43	}
17cba269 MHS	44
cee5a30d	45	int CmdHFiClassList(const char *Cmd)
17cba269 MHS	46	{
	47
	48	bool ShowWaitCycles = false;
	49	char param = param_getchar(Cmd, 0);
	50
	51	if (param != 0) {
	52	PrintAndLog("List data in trace buffer.");
	53	PrintAndLog("Usage: hf iclass list");
	54	PrintAndLog("h - help");
	55	PrintAndLog("sample: hf iclass list");
	56	return 0;
	57	}
	58
	59	uint8_t got[1920];
	60	GetFromBigBuf(got,sizeof(got),0);
	61	WaitForResponse(CMD_ACK,NULL);
	62
	63	PrintAndLog("Recorded Activity");
	64	PrintAndLog("");
	65	PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
	66	PrintAndLog("All times are in carrier periods (1/13.56Mhz)");
	67	PrintAndLog("");
	68	PrintAndLog(" Start \| End \| Src \| Data");
	69	PrintAndLog("-----------\|-----------\|-----\|--------");
	70
	71	int i;
	72	uint32_t first_timestamp = 0;
	73	uint32_t timestamp;
	74	bool tagToReader;
	75	uint32_t parityBits;
	76	uint8_t len;
	77	uint8_t *frame;
	78	uint32_t EndOfTransmissionTimestamp = 0;
	79
17cba269 MHS	80
	81	for( i=0; i < 1900;)
	82	{
	83	//First 32 bits contain
	84	// isResponse (1 bit)
	85	// timestamp (remaining)
	86	//Then paritybits
	87	//Then length
	88	timestamp = ((uint32_t )(got+i));
	89	parityBits = ((uint32_t )(got+i+4));
	90	len = got[i+8];
26c0d833	91	frame = (got+i+9);
17cba269 MHS	92	uint32_t next_timestamp = (((uint32_t )(got+i+9))) & 0x7fffffff;
	93
	94	tagToReader = timestamp & 0x80000000;
	95	timestamp &= 0x7fffffff;
	96
	97	if(i==0) {
	98	first_timestamp = timestamp;
	99	}
	100
26c0d833	101	// Break and stick with current result idf buffer was not completely full
f83cc126	102	if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break;
17cba269 MHS	103
	104	char line[1000] = "";
	105
	106	if(len)//We have some data to display
	107	{
	108	int j,oddparity;
	109
	110	for(j = 0; j < len ; j++)
	111	{
	112	oddparity = 0x01 ^ xorbits_8(frame[j] & 0xFF);
	113
	114	if (tagToReader && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
	115	sprintf(line+(j*4), "%02x! ", frame[j]);
	116	} else {
	117	sprintf(line+(j*4), "%02x ", frame[j]);
	118	}
	119	}
	120	}else
	121	{
	122	if (ShowWaitCycles) {
	123	sprintf(line, "fdt (Frame Delay Time): %d", (next_timestamp - timestamp));
	124	}
	125	}
	126
	127	char *crc = "";
	128
	129	if(len > 2)
	130	{
	131	uint8_t b1, b2;
	132	if(!tagToReader && len == 4) {
	133	// Rough guess that this is a command from the reader
	134	// For iClass the command byte is not part of the CRC
	135	ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
	136	}
	137	else {
	138	// For other data.. CRC might not be applicable (UPDATE commands etc.)
	139	ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
	140	}
	141
	142	if (b1 != frame[len-2] \|\| b2 != frame[len-1]) {
	143	crc = (tagToReader & (len < 8)) ? "" : " !crc";
	144	}
	145	}
	146
	147	i += (len + 9);
	148	EndOfTransmissionTimestamp = (((uint32_t )(got+i))) & 0x7fffffff;
	149
	150	// Not implemented for iclass on the ARM-side
	151	//if (!ShowWaitCycles) i += 9;
	152
	153	PrintAndLog(" %9d \| %9d \| %s \| %s %s",
	154	(timestamp - first_timestamp),
	155	(EndOfTransmissionTimestamp - first_timestamp),
	156	(len?(tagToReader ? "Tag" : "Rdr"):" "),
	157	line, crc);
	158	}
	159	return 0;
	160	}
	161
	162	int CmdHFiClassListOld(const char *Cmd)
cee5a30d	163	{
cee5a30d	164	uint8_t got[1920];
db09cb3a	165	GetFromBigBuf(got,sizeof(got),0);
cee5a30d	166
	167	PrintAndLog("recorded activity:");
	168	PrintAndLog(" ETU :rssi: who bytes");
	169	PrintAndLog("---------+----+----+-----------");
	170
	171	int i = 0;
	172	int prev = -1;
	173
	174	for (;;) {
	175	if(i >= 1900) {
	176	break;
	177	}
	178
	179	bool isResponse;
	180	int timestamp = ((uint32_t )(got+i));
	181	if (timestamp & 0x80000000) {
	182	timestamp &= 0x7fffffff;
	183	isResponse = 1;
	184	} else {
	185	isResponse = 0;
	186	}
	187
17cba269	188
cee5a30d	189	int metric = 0;
17cba269	190
cee5a30d	191	int parityBits = ((uint32_t )(got+i+4));
	192	// 4 bytes of additional information...
	193	// maximum of 32 additional parity bit information
	194	//
	195	// TODO:
	196	// at each quarter bit period we can send power level (16 levels)
	197	// or each half bit period in 256 levels.
	198
	199
	200	int len = got[i+8];
	201
	202	if (len > 100) {
	203	break;
	204	}
	205	if (i + len >= 1900) {
	206	break;
	207	}
	208
	209	uint8_t *frame = (got+i+9);
	210
	211	// Break and stick with current result if buffer was not completely full
	212	if (frame[0] == 0x44 && frame[1] == 0x44 && frame[3] == 0x44) { break; }
	213
	214	char line[1000] = "";
	215	int j;
	216	for (j = 0; j < len; j++) {
	217	int oddparity = 0x01;
	218	int k;
	219
	220	for (k=0;k<8;k++) {
	221	oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
	222	}
	223
	224	//if((parityBits >> (len - j - 1)) & 0x01) {
	225	if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
	226	sprintf(line+(j*4), "%02x! ", frame[j]);
	227	}
	228	else {
	229	sprintf(line+(j*4), "%02x ", frame[j]);
	230	}
	231	}
	232
	233	char *crc;
	234	crc = "";
	235	if (len > 2) {
	236	uint8_t b1, b2;
	237	for (j = 0; j < (len - 1); j++) {
	238	// gives problems... search for the reason..
	239	/*if(frame[j] == 0xAA) {
	240	switch(frame[j+1]) {
	241	case 0x01:
	242	crc = "[1] Two drops close after each other";
	243	break;
	244	case 0x02:
	245	crc = "[2] Potential SOC with a drop in second half of bitperiod";
	246	break;
	247	case 0x03:
	248	crc = "[3] Segment Z after segment X is not possible";
	249	break;
	250	case 0x04:
	251	crc = "[4] Parity bit of a fully received byte was wrong";
	252	break;
	253	default:
	254	crc = "[?] Unknown error";
255	break;
256	}
257	break;
258	}*/
259	}
260
261	if (strlen(crc)==0) {
262	if(!isResponse && len == 4) {
263	// Rough guess that this is a command from the reader
264	// For iClass the command byte is not part of the CRC
265	ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
266	}
267	else {
268	// For other data.. CRC might not be applicable (UPDATE commands etc.)
269	ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
270	}
271	//printf("%1x %1x",(unsigned)b1,(unsigned)b2);
272	if (b1 != frame[len-2] \|\| b2 != frame[len-1]) {
273	crc = (isResponse & (len < 8)) ? "" : " !crc";
274	} else {
275	crc = "";
276	}
277	}
278	} else {
279	crc = ""; // SHORT
280	}
281
282	char metricString[100];
283	if (isResponse) {
284	sprintf(metricString, "%3d", metric);
285	} else {
286	strcpy(metricString, " ");
287	}
288
289	PrintAndLog(" +%7d: %s: %s %s %s",
290	(prev < 0 ? 0 : (timestamp - prev)),
291	metricString,
292	(isResponse ? "TAG" : " "), line, crc);
293
294	prev = timestamp;
295	i += (len + 9);
296	}
297	return 0;
298	}
299
cee5a30d	300	int CmdHFiClassSnoop(const char *Cmd)
	301	{
	302	UsbCommand c = {CMD_SNOOP_ICLASS};
	303	SendCommand(&c);
	304	return 0;
	305	}
6116c796	306	#define NUM_CSNS 15
1e262141	307	int CmdHFiClassSim(const char *Cmd)
	308	{
	309	uint8_t simType = 0;
	310	uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
	311
17cba269 MHS	312	if (strlen(Cmd)<1) {
	313	PrintAndLog("Usage: hf iclass sim [0 <CSN>] \| x");
	314	PrintAndLog(" options");
	315	PrintAndLog(" 0 <CSN> simulate the given CSN");
	316	PrintAndLog(" 1 simulate default CSN");
	317	PrintAndLog(" 2 iterate CSNs, gather MACs");
1e262141	318	PrintAndLog(" sample: hf iclass sim 0 031FEC8AF7FF12E0");
17cba269	319	PrintAndLog(" sample: hf iclass sim 2");
1e262141	320	return 0;
	321	}
	322
	323	simType = param_get8(Cmd, 0);
17cba269 MHS	324
	325	if(simType == 0)
	326	{
	327	if (param_gethex(Cmd, 1, CSN, 16)) {
	328	PrintAndLog("A CSN should consist of 16 HEX symbols");
	329	return 1;
	330	}
	331	PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
	332
	333	}
77abe781	334	if(simType > 2)
17cba269 MHS	335	{
	336	PrintAndLog("Undefined simptype %d", simType);
	337	return 1;
1e262141	338	}
17cba269	339	uint8_t numberOfCSNs=0;
1e262141	340
9f6e9d15 MHS	341	if(simType == 2)
9f6e9d15 MHS	342	{
6116c796	343	UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
9f6e9d15	344	UsbCommand resp = {0};
17cba269	345
6116c796	346	/uint8_t csns[8 NUM_CSNS] = {
77abe781 MHS	347	0x00,0x0B,0x0F,0xFF,0xF7,0xFF,0x12,0xE0 ,
	348	0x00,0x13,0x94,0x7e,0x76,0xff,0x12,0xe0 ,
	349	0x2a,0x99,0xac,0x79,0xec,0xff,0x12,0xe0 ,
	350	0x17,0x12,0x01,0xfd,0xf7,0xff,0x12,0xe0 ,
	351	0xcd,0x56,0x01,0x7c,0x6f,0xff,0x12,0xe0 ,
	352	0x4b,0x5e,0x0b,0x72,0xef,0xff,0x12,0xe0 ,
	353	0x00,0x73,0xd8,0x75,0x58,0xff,0x12,0xe0 ,
	354	0x0c,0x90,0x32,0xf3,0x5d,0xff,0x12,0xe0 };
6116c796 MHS	355	*/
	356
	357	uint8_t csns[8*NUM_CSNS] = {
	358	0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
	359	0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
	360	0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
	361	0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
	362	0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
	363	0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
	364	0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
	365	0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
	366	0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
	367	0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
	368	0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
	369	0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
	370	0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
	371	0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
	372	0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
	373
	374	memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
9f6e9d15 MHS	375
	376	SendCommand(&c);
	377	if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
	378	PrintAndLog("Command timed out");
	379	return 0;
	380	}
1e262141	381
77abe781	382	uint8_t num_mac_responses = resp.arg[1];
6116c796	383	PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
9f6e9d15	384
6116c796	385	size_t datalen = NUM_CSNS*24;
9f6e9d15 MHS	386	/*
9f6e9d15 MHS	387	* Now, time to dump to file. We'll use this format:
77abe781	388	* <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
9f6e9d15	389	* So, it should wind up as
77abe781 MHS	390	* 8 * 24 bytes.
	391	*
	392	* The returndata from the pm3 is on the following format
	393	* <4 byte NR><4 byte MAC>
	394	* CC are all zeroes, CSN is the same as was sent in
9f6e9d15	395	**/
77abe781 MHS	396	void* dump = malloc(datalen);
77abe781 MHS	397	memset(dump,0,datalen);//<-- Need zeroes for the CC-field
9f6e9d15	398	uint8_t i = 0;
6116c796	399	for(i = 0 ; i < NUM_CSNS ; i++)
9f6e9d15	400	{
77abe781 MHS	401	memcpy(dump+i24, csns+i8,8); //CSN
	402	//8 zero bytes here...
	403	//Then comes NR_MAC (eight bytes from the response)
	404	memcpy(dump+i24+16,resp.d.asBytes+i8,8);
1e262141	405
9f6e9d15 MHS	406	}
9f6e9d15 MHS	407	/ Now, save to dumpfile /
77abe781 MHS	408	saveFile("iclass_mac_attack", "bin", dump,datalen);
77abe781 MHS	409	free(dump);
9f6e9d15 MHS	410	}else
	411	{
	412	UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
	413	memcpy(c.d.asBytes, CSN, 8);
	414	SendCommand(&c);
	415	}
1e262141	416
1e262141	417	return 0;
	418	}
	419
	420	int CmdHFiClassReader(const char *Cmd)
	421	{
aa41c605	422	UsbCommand c = {CMD_READER_ICLASS, {0}};
1e262141	423	SendCommand(&c);
aa41c605 MHS	424	UsbCommand resp;
	425	while(!ukbhit()){
	426	if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
	427	uint8_t isOK = resp.arg[0] & 0xff;
	428	uint8_t * data = resp.d.asBytes;
	429
	430	PrintAndLog("isOk:%02x", isOK);
	431
	432	if(isOK > 0)
	433	{
	434	PrintAndLog("CSN: %s",sprint_hex(data,8));
	435	}
	436	if(isOK >= 1)
	437	{
	438	PrintAndLog("CC: %s",sprint_hex(data+8,8));
	439	}else{
	440	PrintAndLog("No CC obtained");
	441	}
	442	} else {
	443	PrintAndLog("Command execute timeout");
	444	}
	445	}
1e262141	446
c3963755	447	return 0;
	448	}
	449
	450	int CmdHFiClassReader_Replay(const char *Cmd)
	451	{
	452	uint8_t readerType = 0;
	453	uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
	454
	455	if (strlen(Cmd)<1) {
	456	PrintAndLog("Usage: hf iclass replay <MAC>");
	457	PrintAndLog(" sample: hf iclass replay 00112233");
	458	return 0;
	459	}
	460
	461	if (param_gethex(Cmd, 0, MAC, 8)) {
	462	PrintAndLog("MAC must include 8 HEX symbols");
	463	return 1;
	464	}
	465
	466	UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
	467	memcpy(c.d.asBytes, MAC, 4);
	468	SendCommand(&c);
1e262141	469
	470	return 0;
	471	}
	472
a66fca86 AD	473	int CmdHFiClassReader_Dump(const char *Cmd)
	474	{
	475	uint8_t readerType = 0;
	476	uint8_t MAC[4]={0x00,0x00,0x00,0x00};
	477	uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	478	uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	479	uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
fecd8202	480	//uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
a66fca86	481	uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
9b82de75 MHS	482	uint8_t keytable[128] = {0};
	483	int elite = 0;
	484	uint8_t *used_key;
	485	int i;
fecd8202	486	if (strlen(Cmd)<1)
fecd8202	487	{
9b82de75 MHS	488	PrintAndLog("Usage: hf iclass dump <Key> [e]");
	489	PrintAndLog(" Key - A 16 byte master key");
	490	PrintAndLog(" e - If 'e' is specified, the key is interpreted as the 16 byte");
	491	PrintAndLog(" Custom Key (KCus), which can be obtained via reader-attack");
	492	PrintAndLog(" See 'hf iclass sim 2'. This key should be on iclass-format");
fecd8202	493	PrintAndLog(" sample: hf iclass dump 0011223344556677");
9b82de75 MHS	494
9b82de75 MHS	495
a66fca86 AD	496	return 0;
	497	}
	498
fecd8202	499	if (param_gethex(Cmd, 0, KEY, 16))
fecd8202	500	{
a66fca86 AD	501	PrintAndLog("KEY must include 16 HEX symbols");
	502	return 1;
	503	}
9b82de75 MHS	504
	505	if (param_getchar(Cmd, 1) == 'e')
	506	{
	507	PrintAndLog("Elite switch on");
	508	elite = 1;
	509
	510	//calc h2
	511	hash2(KEY, keytable);
9e28ee9f	512	printarr_human_readable("keytable", keytable, 128);
9b82de75 MHS	513
	514	}
	515
0eea34a2 MHS	516	UsbCommand resp;
	517	uint8_t key_sel[8] = {0};
	518	uint8_t key_sel_p[8] = { 0 };
	519
	520	//HACK -- Below is for testing without access to a tag
	521	uint8_t xdata[16] = {0x01,0x02,0x03,0x04,0xF7,0xFF,0x12,0xE0, //CSN from http://www.proxmark.org/forum/viewtopic.php?pid=11230#p11230
	522	0xFE,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF}; // Just a random CC. Would be good to add a real testcase here
	523	memcpy(resp.d.asBytes,xdata, 16);
	524	resp.arg[0] = 2;
	525	uint8_t fake_dummy_test = false;
	526	//End hack
	527
9b82de75	528
aa41c605 MHS	529	UsbCommand c = {CMD_READER_ICLASS, {0}};
aa41c605 MHS	530	c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE;
0eea34a2 MHS	531	if(!fake_dummy_test)
0eea34a2 MHS	532	SendCommand(&c);
fecd8202	533
26c0d833	534
0eea34a2 MHS	535
0eea34a2 MHS	536	if (fake_dummy_test \|\| WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
26c0d833 MHS	537	uint8_t isOK = resp.arg[0] & 0xff;
	538	uint8_t * data = resp.d.asBytes;
	539
26c0d833 MHS	540	memcpy(CSN,data,8);
26c0d833 MHS	541	memcpy(CCNR,data+8,8);
3ad48540	542
26c0d833	543	PrintAndLog("isOk:%02x", isOK);
a66fca86	544
aa41c605	545	if(isOK > 0)
26c0d833 MHS	546	{
	547	PrintAndLog("CSN: %s",sprint_hex(CSN,8));
	548	}
9b82de75	549	if(isOK > 1)
26c0d833	550	{
9b82de75 MHS	551	if(elite)
9b82de75 MHS	552	{
9b82de75 MHS	553	//Get the key index (hash1)
	554	uint8_t key_index[8] = {0};
	555
	556	hash1(CSN, key_index);
	557	printvar("hash1", key_index,8);
	558	for(i = 0; i < 8 ; i++)
	559	key_sel[i] = keytable[key_index[i]] & 0xFF;
0eea34a2	560	PrintAndLog("Pre-fortified 'permuted' HS key that would be needed by an iclass reader to talk to above CSN:");
9b82de75 MHS	561	printvar("k_sel", key_sel,8);
	562	//Permute from iclass format to standard format
	563	permutekey_rev(key_sel,key_sel_p);
	564	used_key = key_sel_p;
	565	}else{
9e28ee9f MHS	566	//Perhaps this should also be permuted to std format?
	567	// Something like the code below? I have no std system
	568	// to test this with /Martin
	569
	570	//uint8_t key_sel_p[8] = { 0 };
	571	//permutekey_rev(KEY,key_sel_p);
	572	//used_key = key_sel_p;
	573
9b82de75 MHS	574	used_key = KEY;
	575
	576	}
0eea34a2 MHS	577
0eea34a2 MHS	578	PrintAndLog("Pre-fortified key that would be needed by the OmniKey reader to talk to above CSN:");
9b82de75 MHS	579	printvar("Used key",used_key,8);
9b82de75 MHS	580	diversifyKey(CSN,used_key, div_key);
0eea34a2	581	PrintAndLog("Hash0, a.k.a diversified key, that is computed using Ksel and stored in the card (Block 3):");
9b82de75	582	printvar("Div key", div_key, 8);
9e28ee9f	583	printvar("CC_NR:",CCNR,12);
74a38802	584	doMAC(CCNR,12,div_key, MAC);
9b82de75 MHS	585	printvar("MAC", MAC, 4);
9b82de75 MHS	586
26c0d833 MHS	587	UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
26c0d833 MHS	588	memcpy(d.d.asBytes, MAC, 4);
0eea34a2	589	if(!fake_dummy_test) SendCommand(&d);
26c0d833 MHS	590
	591	}else{
	592	PrintAndLog("Failed to obtain CC! Aborting");
	593	}
	594	} else {
	595	PrintAndLog("Command execute timeout");
	596	}
1e262141	597
	598	return 0;
	599	}
	600
fecd8202	601	int CmdHFiClass_iso14443A_write(const char *Cmd)
	602	{
	603	uint8_t readerType = 0;
	604	uint8_t MAC[4]={0x00,0x00,0x00,0x00};
	605	uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	606	uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
	607	uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
fecd8202	608	uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
3ad48540	609
fecd8202	610	uint8_t blockNo=0;
	611	uint8_t bldata[8]={0};
	612
	613	if (strlen(Cmd)<3)
	614	{
	615	PrintAndLog("Usage: hf iclass write <Key> <Block> <Data>");
	616	PrintAndLog(" sample: hf iclass write 0011223344556677 10 AAAAAAAAAAAAAAAA");
	617	return 0;
	618	}
	619
	620	if (param_gethex(Cmd, 0, KEY, 16))
	621	{
	622	PrintAndLog("KEY must include 16 HEX symbols");
	623	return 1;
	624	}
	625
	626	blockNo = param_get8(Cmd, 1);
	627	if (blockNo>32)
	628	{
	629	PrintAndLog("Error: Maximum number of blocks is 32 for iClass 2K Cards!");
	630	return 1;
	631	}
	632	if (param_gethex(Cmd, 2, bldata, 8))
	633	{
	634	PrintAndLog("Block data must include 8 HEX symbols");
	635	return 1;
	636	}
	637
aa41c605	638	UsbCommand c = {CMD_ICLASS_ISO14443A_WRITE, {0}};
fecd8202	639	SendCommand(&c);
fecd8202	640	UsbCommand resp;
3ad48540	641
fecd8202	642	if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
	643	uint8_t isOK = resp.arg[0] & 0xff;
	644	uint8_t * data = resp.d.asBytes;
	645
	646	memcpy(CSN,data,8);
	647	memcpy(CCNR,data+8,8);
	648	PrintAndLog("DEBUG: %s",sprint_hex(CSN,8));
	649	PrintAndLog("DEBUG: %s",sprint_hex(CCNR,8));
	650	PrintAndLog("isOk:%02x", isOK);
	651	} else {
	652	PrintAndLog("Command execute timeout");
	653	}
3ad48540 MHS	654
	655	diversifyKey(CSN,KEY, div_key);
	656
fecd8202	657	PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
74a38802	658	doMAC(CCNR, 12,div_key, MAC);
fecd8202	659
3ad48540 MHS	660	UsbCommand c2 = {CMD_ICLASS_ISO14443A_WRITE, {readerType,blockNo}};
	661	memcpy(c2.d.asBytes, bldata, 8);
	662	memcpy(c2.d.asBytes+8, MAC, 4);
	663	SendCommand(&c2);
a66fca86	664
fecd8202	665	if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
	666	uint8_t isOK = resp.arg[0] & 0xff;
	667	uint8_t * data = resp.d.asBytes;
	668
	669	if (isOK)
	670	PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));
	671	else
	672	PrintAndLog("isOk:%02x", isOK);
	673	} else {
	674	PrintAndLog("Command execute timeout");
	675	}
a66fca86 AD	676	return 0;
	677	}
	678
c3963755	679
cee5a30d	680	static command_t CommandTable[] =
cee5a30d	681	{
fecd8202	682	{"help", CmdHelp, 1, "This help"},
	683	{"list", CmdHFiClassList, 0, "List iClass history"},
	684	{"snoop", CmdHFiClassSnoop, 0, "Eavesdrop iClass communication"},
	685	{"sim", CmdHFiClassSim, 0, "Simulate iClass tag"},
	686	{"reader",CmdHFiClassReader, 0, "Read an iClass tag"},
	687	{"replay",CmdHFiClassReader_Replay, 0, "Read an iClass tag via Reply Attack"},
	688	{"dump", CmdHFiClassReader_Dump, 0, "Authenticate and Dump iClass tag"},
	689	{"write", CmdHFiClass_iso14443A_write, 0, "Authenticate and Write iClass block"},
cee5a30d	690	{NULL, NULL, 0, NULL}
	691	};
	692
	693	int CmdHFiClass(const char *Cmd)
	694	{
	695	CmdsParse(CommandTable, Cmd);
	696	return 0;
	697	}
	698
	699	int CmdHelp(const char *Cmd)
	700	{
	701	CmdsHelp(CommandTable);
	702	return 0;
	703	}